IAM problem with BigQuery?

[mwarkentin]

TACOS plan failing: https://github.com/getsentry/ops/pull/13021#issuecomment-2508022019

$ sudo-gcp terragrunt run-all refresh
ERROR: command failed: sudo-gcp terragrunt run-all refresh
You are authenticated for the next hour as: [email protected]
google_bigquery_dataset.main: Refreshing state... [id=projects/sentry-eu-west3/datasets/fastly_logs]
google_bigquery_table.main["js_sentry_cdn_loader"]: Refreshing state... [id=projects/sentry-eu-west3/datasets/fastly_logs/tables/js_sentry_cdn_loader]
╷
│ Error: Error when reading or editing BigQuery table "js_sentry_cdn_loader": googleapi: Error 403: Access Denied: Table sentry-eu-west3:fastly_logs.js_sentry_cdn_loader: Permission bigquery.tables.get denied on table sentry-eu-west3:fastly_logs.js_sentry_cdn_loader (or it may not exist)., accessDenied
│ 
│   with google_bigquery_table.main["js_sentry_cdn_loader"],
│   on main.tf line 67, in resource "google_bigquery_table" "main":
│   67: resource "google_bigquery_table" "main" {

I'm able to successfully run this plan locally though:

bigquery/fastly-cdn/de on  keeakita/fix/bigquery [$+?] via 🐍 v3.11.6 (.venv-sentry-kube) on ☁️  [email protected](us-central1) took 4s
❯ rm -rf .terragrunt-cache/ && tg init -upgrade && tg plan -lock=false

Initializing the backend...

Successfully configured the backend "gcs"! Terraform will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding hashicorp/google versions matching "6.9.0"...
- Finding hashicorp/google-beta versions matching "6.9.0"...
- Finding hashicorp/random versions matching "~> 3.1.0"...
- Installing hashicorp/google v6.9.0...
- Installed hashicorp/google v6.9.0 (signed by HashiCorp)
- Installing hashicorp/google-beta v6.9.0...
- Installed hashicorp/google-beta v6.9.0 (signed by HashiCorp)
- Installing hashicorp/random v3.1.3...
- Installed hashicorp/random v3.1.3 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Initializing the backend...

Initializing provider plugins...
- Reusing previous version of hashicorp/random from the dependency lock file
- Reusing previous version of hashicorp/google from the dependency lock file
- Reusing previous version of hashicorp/google-beta from the dependency lock file
- Using previously-installed hashicorp/random v3.1.3
- Using previously-installed hashicorp/google v6.9.0
- Using previously-installed hashicorp/google-beta v6.9.0

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
google_bigquery_dataset.main: Refreshing state... [id=projects/sentry-eu-west3/datasets/fastly_logs]
google_bigquery_table.main["js_sentry_cdn_loader"]: Refreshing state... [id=projects/sentry-eu-west3/datasets/fastly_logs/tables/js_sentry_cdn_loader]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # google_bigquery_dataset.main will be updated in-place
  ~ resource "google_bigquery_dataset" "main" {
      - default_table_expiration_ms     = 2592000000 -> null
        id                              = "projects/sentry-eu-west3/datasets/fastly_logs"
        # (17 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Changes to Outputs:
  ~ bigquery_dataset         = {
      ~ default_table_expiration_ms      = 2592000000 -> null
        id                               = "projects/sentry-eu-west3/datasets/fastly_logs"
        # (23 unchanged attributes hidden)
    }
  ~ bigquery_tables          = {
      ~ js_sentry_cdn_loader = {
            id                          = "projects/sentry-eu-west3/datasets/fastly_logs/tables/js_sentry_cdn_loader"
          ~ resource_tags               = null -> {}
            # (32 unchanged attributes hidden)
        }
    }